CVE-2024-24573

CVSS V2 None CVSS V3 None

Description

facileManager is a modular suite of web apps built with the sysadmin in mind. In versions 4.5.0 and earlier, when a user updates their profile, a POST request containing user information is sent to the endpoint server/fm-modules/facileManager/ajax/processPost.php. It was found that non-admins can arbitrarily set their permissions and grant their non-admin accounts with super user privileges.

Overview

CVE ID
CVE-2024-24573

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-01-31T22:33:11.697Z

Last Modified Date
2024-01-31T22:33:11.697Z

Weakness Enumerations

CWE	URL
CWE-863	http://cwe.mitre.org/data/definitions/863.html

References

Reference URL	Reference Tags
https://github.com/WillyXJ/facileManager/security/advisories/GHSA-w67q-pp62-j4pf	x_refsource_CONFIRM
https://github.com/WillyXJ/facileManager/commit/0aa850d4b518f10143a4c675142b15caa5872877	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-24573
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-24573

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 04:17:26				Added to TrackCVE